SmarterMail versions before 9526 contain a cross‑site scripting vulnerability that can be triggered through malformed MAPI requests. The flaw, identified as CWE‑79, permits an attacker to inject arbitrary HTML or JavaScript into a user’s browser context, enabling defacement or session hijacking if the victim interacts with the injected content. The primary impact is on confidentiality and integrity of the authenticated user session rather than full remote code execution.

SmarterTools SmarterMail products with versions earlier than 9526 are affected. The advisory lists SmarterTools as vendor and SmarterMail as product; no more detailed version range is specified beyond the mention of 9526 as the first fixed release.

The CVSS score of 7.2 indicates a high severity, and the EPSS score of less than 1% shows a low predicted exploitation probability at present. The vulnerability is not listed in KEV. The attack vector is inferred to require an attacker’s ability to send specially crafted MAPI requests to the SmarterMail server, potentially exploiting exposed API endpoints or compromised credentials. The lack of explicit prerequisites suggests that the flaw is exploitable via network interfaces that allow MAPI traffic. The impact is limited to the victim’s browser session and does not provide arbitrary code execution on the server.